Written consent

Learn how to collect and check a nonprofit’s written consent for your platform.

Donation platforms should collect written consent from nonprofits before granting funds to them. Platforms can check a nonprofit’s consent status through Change’s APIs. On Change, nonprofits affirmatively opt in to provide written consent on a per-platform basis and may update their consent status at any time.

Note: The API requests in this guide read or filter existing consent; they do not grant consent on a nonprofit’s behalf. Nonprofits manage their own consent preferences.

1. Understand consent status

There are two types of written consent:

These consent types are independent: a nonprofit can grant either, both, or neither. Via Change consent does not imply Direct consent to your platform.

Direct consent is specific to your platform. A nonprofit’s consent to another platform does not grant consent to yours. Nonprofits can also choose to automatically grant Direct consent to platforms. An explicit decision to withhold consent from your platform overrides that automatic consent.

2. Collect consent

Via Change consent is collected automatically when nonprofits sign up and agree to Change’s terms.

Direct consent is also collected during sign-up. Nonprofits are presented with a list of companies to review. They can opt in to or out of receiving donations from each platform individually. When a nonprofit opts in to receive donations from your specific platform, it grants Direct consent to your platform.

To have your platform appear on the Direct consent list, contact Change support at support@getchange.io.

3. Retrieve a nonprofit’s consent

First, sign up for a Change account and get your API keys. Use the Show a Nonprofit endpoint:

curl "https://api.getchange.io/api/v1/nonprofits/n_MUjmT5yhdf4smx1ykRwO2ovt" \
  -u "YOUR_PUBLIC_KEY:YOUR_SECRET_KEY"

The response includes written_consent. This illustrative response shows only the relevant fields; actual consent values depend on the nonprofit and your account:

{
  "id": "n_MUjmT5yhdf4smx1ykRwO2ovt",
  "name": "One Tree Planted",
  "written_consent": {
    "via_change": true,
    "direct": false
  }
}

In this example, the nonprofit has granted consent via Change, but has not granted direct consent to your account. If your integration requires direct consent, check that written_consent.direct is true.

4. Filter nonprofit searches

You can also use the Search a nonprofit endpoint to return nonprofits matching your consent criteria. Pass consent filters as nested query parameters:

Set a filter to true to require that consent, or false to find nonprofits without it. Omit a filter to leave that consent field unrestricted.

Find nonprofits with direct consent

curl --get "https://api.getchange.io/api/v1/nonprofits" \
  --data-urlencode "public_key=YOUR_PUBLIC_KEY" \
  --data-urlencode "written_consent[direct]=true" \
  --data-urlencode "limit=10" \
  --data-urlencode "page=1"

The response contains a nonprofits array. Each Nonprofit object includes its written_consent values. Search results are paginated; use page and limit to retrieve additional results.

Find nonprofits with consent via Change

curl --get "https://api.getchange.io/api/v1/nonprofits" \
  --data-urlencode "public_key=YOUR_PUBLIC_KEY" \
  --data-urlencode "written_consent[via_change]=true"

Combine consent filters

When you supply both filters, a nonprofit must match both conditions. For example, find nonprofits that have granted consent via Change but have not granted direct consent to your account:

curl --get "https://api.getchange.io/api/v1/nonprofits" \
  --data-urlencode "public_key=YOUR_PUBLIC_KEY" \
  --data-urlencode "written_consent[via_change]=true" \
  --data-urlencode "written_consent[direct]=false"

Setting both filters to true requires both types of consent. To find nonprofits with either type of consent, run a search for each type and combine the results, removing duplicates by nonprofit ID.

You can combine consent filters with other search parameters, such as search_term or categories[]. Use the nested parameter names shown above: a flat value such as written_consent=direct, or an unrecognized consent filter key, yields a 400 Bad Request.

5. Keep consent status up to date

Nonprofits can change their consent preferences. Refresh consent values when updating your nonprofit selection, and retrieve the nonprofit again when you need its current consent status.

The requests in this guide read or filter existing consent; they do not grant consent on a nonprofit’s behalf. Nonprofits manage their consent preferences through Change.